# CVE-2026-20135: Cisco Secure Firewall Threat Defense TLS 1.3 denial of service

Source: https://junglewise.ai/threats/cve-2026-20135-cisco-secure-firewall-threat-defense-tls-1-3-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-20135 · Severity: high · CVSS 8.6 · Published 2026-09-16

A denial of service vulnerability exists in Cisco Secure Firewall Threat Defense (FTD), a widely deployed network security appliance. An unauthenticated attacker can crash the device remotely by sending a malicious TLS 1.3 packet, forcing an unexpected reload and disrupting network operations. This can affect both management and data traffic if TLS 1.3 is enabled.

Technologies: [Cisco Secure Firewall Threat Defense (FTD)](https://junglewise.ai/threats/technologies/firepower-threat-defense-software). Vendors: [Cisco](https://junglewise.ai/threats/vendors/cisco).

## Quick answers

**Is CVE-2026-20135 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-20135 being exploited in the wild.

**How severe is CVE-2026-20135?** High severity, with a CVSS score of 8.6, published 16 September 2026.

**Which products and versions are affected?** Cisco Secure Firewall Threat Defense (FTD) See vendor advisory for affected releases.

**Is there a fix for CVE-2026-20135?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-20135 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-20135?** Check whether you run Cisco Secure Firewall Threat Defense (FTD) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability stems from improper buffer management in the TLS 1.3 implementation within the LINA process. An unauthenticated, remote attacker can exploit this by sending a crafted TLS 1.3 packet to any TLS 1.3-enabled listening socket (commonly ports 443 or 8443). The vulnerability can be triggered before or after authentication, resulting in process crash and device reload. Cisco has released software patches; no workarounds exist, though administrators can temporarily disable TLS 1.3 and revert to TLS 1.2.

## Affected products

- Cisco Secure Firewall Threat Defense (FTD) See vendor advisory for affected releases

## Timeline

- 2026-09-16: disclosed

## References

- [https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls1.3-dos-dLxwFWgF](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-tls1.3-dos-dLxwFWgF)

## Related threats

- [Cisco Secure Firewall ASA and FTD EIGRP denial of service](https://junglewise.ai/threats/cve-2026-20222-cisco-secure-firewall-asa-and-ftd-eigrp-denial-of-service)
- [Cisco Snort 3 detection engine denial of service](https://junglewise.ai/threats/cve-2026-20067-cisco-snort-3-detection-engine-denial-of-service)
- [Cisco Snort 3 VBA decompression denial of service](https://junglewise.ai/threats/cve-2026-20058-cisco-snort-3-vba-decompression-denial-of-service)
- [Cisco Snort 3 VBA decompression denial of service](https://junglewise.ai/threats/cve-2026-20054-cisco-snort-3-vba-decompression-denial-of-service)
- [Cisco Secure Firewall ASA and FTD VPN web server denial of service](https://junglewise.ai/threats/cve-2026-20039-cisco-secure-firewall-asa-and-ftd-vpn-web-server-denial-of)